File scan report
Verdict Suspicious
Is uplay_
This unsigned, heavily protected game-platform loader DLL draws 5 of 75 generic or rule-based detections, with no named malware family and a long, widespread submission history.
Read the whole reasonShow less
Why Suspicious? 5 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Avoid running this unofficial loader; use the official game client and keep your antivirus enabled, and delete the file if you did not intentionally obtain it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't use it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already used it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
5 of 69 flagged
- Flagged 5
- No detection 64
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 11y ago
Chapter 02
Why we think so
4 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Five of the 69 antivirus engines that checked it flag this DLL, including one major antivirus engine with a generic trojan label and others with rule or grayware labels. It is unsigned, wrapped in a code-protection layer and looks like a game-platform emulator loader of the kind shipped with cracked games, first seen on Nov 17, 2014.
The detections are generic: TrendMicro-HouseCall reports a generic trojan, CrowdStrike calls it grayware, and DeepInstinct, Malwarebytes and APEX give rule-based verdicts, with no family named. The binary carries high-entropy protected sections, and a community annotation links it to a VMProtect obfuscation rule, which commonly triggers rule-based engines. It has no signature, so no publisher vouches for it. On the benign side, more than 1,100 sources have shared it, no reference database lists it, and the sandbox summary recorded no malicious verdict, no injection target and no network contacts. That mix points to an unofficial game loader whose origin cannot be verified rather than confirmed malware.
What We Detected
5 of the 69 antivirus engines that checked it flagged this DLL. The only major detection is TrendMicro-HouseCall with a generic trojan label; CrowdStrike labels it grayware, and DeepInstinct, Malwarebytes and APEX give rule-based verdicts. No engine names a malware family. The file is unsigned and its code sits in high-entropy protected sections, and a community annotation associates it with a VMProtect obfuscation rule.
Threat Behavior
The sandbox runs loaded the DLL and called exports that imitate a game platform's achievement functions. No injected processes, persistence or network contacts were recorded, and no malicious sandbox verdict exists; no complete host-reputation result is available.
What To Do Now
Files like this usually come with unofficial or cracked game copies, a common route for malware. Use the official game client, keep your security software enabled, and remove the file if you did not knowingly install it.
Where this verdict could be wrong2 caveats
- The file has been shared by over 1,100 sources since 2014 with no malware family named, no malicious sandbox verdict and no reference-database listing, so the detections may be rule-based reactions to its protection layer.
- The exported functions mimic a game platform's achievement API, consistent with an emulator DLL rather than a trojan.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Shared by more than 1,100 sources since Nov 17, 2014
- No malware family named by any engine
- No listing in MalwareBazaar, YARAify or CIRCL
- No malicious sandbox verdict, injection target or network contact recorded
- Unsigned DLL with no publisher identity
- Flagged by 5 of the 69 antivirus engines that checked it, including one major antivirus engine with a generic trojan label
- Code is hidden in high-entropy protected sections
- Looks like a game-platform emulator loader typically bundled with cracked games
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 7spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
uplay_r1_loader64.dll
4c77344481222f5537d1f0776f0a3f86f6724d57ede0590c72b0ff97e99ccb1d
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
rundll32.exe
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\readme.dll",#1
Test run - Evidence 3 of 4: ProcessSeen in the test run
loaddll64.exe
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\readme.dll"
Test run - +1 more recorded observation
- 1
Files
Created or changed
- Evidence 4 of 4: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run
4 facts from the test run. See the full activity list.
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1055· Process injection
- T1082· System recon
- T1218.011
- T1497· Sandbox evasion
- T1574.002· Execution hijack
Observed activity
Processes started
7Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\readme.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\readme.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\readme.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,THEGFWrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,UPLAY_ACH_EarnAchievement
Show all 7 entries for processes started
rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,UPLAY_ACH_GetAchievementImage
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Chapter 04
Technical details
5 of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 5
- TrendMicro-HouseCall (major engine)Trojan.Win64.Gen.TL0101DM26ZU
- APEXMalicious
- CrowdStrikewin/grayware_confidence_100% (W)
- DeepInstinctMALICIOUS
- MalwarebytesMalware.Heuristic.2106
File fingerprint
- Last analyzed
- Sep 8, 2026, 7:04 PM UTC
- SHA-256
4c77344481222f5537d1f0776f0a3f86f6724d57ede0590c72b0ff97e99ccb1d- SHA-1
3de9c0314977e48a07be1e03c03867f54159fc38- MD5
e15acddcf04f501c7c28e152d8b2f007
About this file
uplay_r1_loader64.dll is a Win32 DLL file of 513.5 kB.
- Type and size
- Win32 DLL · 513.5 kB
- Signer
- UnsignedNo code signature.
- First seen
- Nov 17, 2014On VirusTotal.
- Submitted by
- 1,153 distinct sources
- Packer
- None detected
- Entropy
- 7.89 of 8
First scanned Updated
Antivirus consensus
5 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines1flagged
- Tier-235 engines3flagged
- Low-trust17 engines1flagged
View all 75 engine results
- APEXMalicious: Malicious
- CrowdStrikeMalicious: win/grayware_confidence_100% (W)
- DeepInstinctMalicious: MALICIOUS
- MalwarebytesMalicious: Malware.Heuristic.2106
- TrendMicro-HouseCallMalicious: Trojan.Win64.Gen.TL0101DM26ZU
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is uplay_r1_loader64.dll safe, or is it malware?
What is uplay_r1_loader64.dll?
How many antivirus engines detected uplay_r1_loader64.dll?
I already downloaded and used uplay_r1_loader64.dll — what should I do?
What is the SHA-256 hash of uplay_r1_loader64.dll?
How up to date is this analysis of uplay_r1_loader64.dll?
Community
Member reviews and reports for this exact file hash.